a110d8607ae1ca197564f46341cb2ad1fc908c91319bd2108fa164db1f4feb29 | Triage

Sharing

General

Target

a110d8607ae1ca197564f46341cb2ad1fc908c91319bd2108fa164db1f4feb29
Size

164KB
Sample

221201-3m89csce67
MD5

5313f9c201fbaaf4be43d7d9e6249b89
SHA1

5cf30234ad84577a51c8f3e72c0eda5f778a198c
SHA256

a110d8607ae1ca197564f46341cb2ad1fc908c91319bd2108fa164db1f4feb29
SHA512

d4387c753268dffd8e79a0cecacb6881ae4d1271a30ba44b0efac0197dac75a33159a4038632443d49fd3a53f4cd479042c8a19b00592e76a677a3b643583b9c
SSDEEP

1536:alhtkWAlIS4i7TLhLsNgqi4Cr3DEaUJBYiVIHvUdR/eDoZJAO1dGV4VE:SWW04i7ZLsNgqE3ofJBYiVIiMDoZ3dG

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  a110d8607ae1ca197564f46341cb2ad1fc908c91319bd2108fa164db1f4feb29
- Size
  
  164KB
- MD5
  
  5313f9c201fbaaf4be43d7d9e6249b89
- SHA1
  
  5cf30234ad84577a51c8f3e72c0eda5f778a198c
- SHA256
  
  a110d8607ae1ca197564f46341cb2ad1fc908c91319bd2108fa164db1f4feb29
- SHA512
  
  d4387c753268dffd8e79a0cecacb6881ae4d1271a30ba44b0efac0197dac75a33159a4038632443d49fd3a53f4cd479042c8a19b00592e76a677a3b643583b9c
- SSDEEP
  
  1536:alhtkWAlIS4i7TLhLsNgqi4Cr3DEaUJBYiVIHvUdR/eDoZJAO1dGV4VE:SWW04i7ZLsNgqE3ofJBYiVIiMDoZ3dG
Score

10^/10

evasion persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence